Atlassian · Bitbucket Server and Data Center
CVE-2022-36804
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
What it is
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
CISA: Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: October 21, 2022
More exploited flaws from Atlassian
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 15, 2026 | Files or Directories Accessible to External Parties | Multiple Products | Critical 9.3 | 99.5% |
| Nov 12, 2024 | Path Traversal | Jira Server and Data Center | Medium 5.3 | >99.9% |
| Jan 24, 2024 | Template Injection | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Nov 7, 2023 | Improper Authorization | Confluence Data Center and Server | Critical 10.0 | >99.9% |
| Oct 5, 2023 | Broken Access Control | Confluence Data Center and Server | Critical 10.0 | 99.2% |
| Jul 29, 2022 | Questions For Confluence App Hard-coded Credentials | Confluence | Critical 9.8 | 98% |
| Jun 2, 2022 | Confluence Server and Data Center Remote Code Execution | Confluence Server/Data Center | Critical 9.8 | >99.9% |
| Mar 28, 2022 | Pre-Authorization Arbitrary File Read | Confluence Server | Medium 5.3 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.